During the Diffie‑Hellman key exchange implemented in OpenSSL, the function EVP_PKEY_derive_set_peer() fails to verify that the peer’s subgroup parameters match the local key. A malicious peer can craft an X9.42 key that uses the victim’s p and g values but substitutes its own small q parameter and a public value Y of that small order. Because the subgroup membership test uses the peer’s q instead of the local q, the bogus key passes all checks. The resulting shared secret has only a few possible values, allowing the attacker to recover the victim’s private DH key after a handful of exchanges, and by repeating the process for each small subgroup can reconstruct the full key using the Chinese remainder theorem.

All OpenSSL FIPS modules up to and including 4.0, 3.6, 3.5, 3.4, and 3.0 are affected. Systems that deploy X9.42 DHX static keys – commonly found in certificate‑management protocols and some government or enterprise applications – are directly exposed.

The vulnerability is not listed in the CISA KEV catalog and has an EPSS score of < 1%, indicating a very low probability of exploitation. The risk is limited to environments that use static X9.42 DHX keys with custom domain parameters; an attacker must actively engage in the key exchange with a malicious peer. Typical internet traffic is largely unaffected, and the CVSS score of 3.7 reflects low severity. However, in the narrow attack surface where the conditions are met, an attacker can recover the private DH key after only a few exchanges.